Third-Party Risk Management Analyst

About This Opportunity

We are representing a confidential IoT platform company in their search for a Third-Party Risk Management Analyst. Our client operates at significant scale, managing security and compliance across a complex vendor ecosystem that supports critical infrastructure operations.

This is a remote position available to candidates residing in the United States, excluding the San Francisco Bay Area, New York City metro, and Washington D.C. metro regions.

Responsibilities

• Lead end-to-end third-party security risk assessments using qualitative and quantitative methods, recommending risk ratings and vendor tiering aligned with the organization's policies
• Own the complete vendor lifecycle including onboarding, reassessment cadence, and remediation tracking of security gaps
• Partner with Legal, Procurement, and system owners to review vendor contracts and onboarding requests, ensuring security requirements (incident notification, data training, compliance) are established before vendors go live
• Escalate unresolved vendor risks to Security leadership, legal, procurement, and business stakeholders as needed
• Support internal and external audits of the vendor risk program (ISO, SOC, FedRAMP)
• Build and maintain metrics, dashboards, and reporting that provide Security leadership visibility into third-party risk posture and program performance
• Support automation and AI-enabled tools in vendor risk workflows, including AI-driven triage of security questionnaires and contract term analysis
• Mentor junior TPRM resources to ensure program scalability and effectiveness

What We're Looking For

Required qualifications:

• 5+ years of experience in third-party/vendor risk management, GRC, or information security compliance
• Experience using automation, scripting, or low-code workflows to scale vendor risk programs
• Hands-on experience conducting vendor security assessments and administering vendor tiering programs
• Experience partnering with Legal and Procurement on vendor contract security and privacy terms (security addendums, DPAs)
• Must reside in the US outside San Francisco Bay Area, New York City, and Washington D.C. metro areas

Preferred qualifications:

• Familiarity with risk assessment frameworks such as NIST CSF, ISO 27001, or SOC 2
• Experience with GRC or vendor risk management platforms (Vanta, ServiceNow, OneTrust, Archer, or similar)
• Relevant certification such as CTPRP, CISA, CRISC, or CISSP

How We Work With You

When you apply through Get A Job.ai, our talent team conducts an initial screening to understand your background and ensure alignment with the role requirements. We then submit qualified candidates to our client for consideration. Throughout the process, we serve as your advocate and main point of contact.

Important: Please apply only through Get A Job.ai. Do not attempt to contact the client directly, as this may disqualify your application.

Pay

This role includes competitive base salary and equity compensation. Specific compensation details will be discussed during the screening process based on your experience and location.

Equal Employment Opportunity: Get A Job.ai is committed to inclusive recruiting practices. We welcome applications from candidates of all backgrounds and ensure all qualified applicants receive consideration without regard to race, color, religion, national origin, sex, gender identity, sexual orientation, protected veteran status, disability, age, or other protected characteristics.